Abusing Findstr for Defense Evasion

SIGMA detection rule by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali · NOASSERTION

Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism

title: Abusing Findstr for Defense Evasion
id: bf6c39fc-e203-45b9-9538-05397c1b4f3f
status: deprecated
description: Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
    - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: 'Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali'
date: 2020/10/05
modified: 2022/10/12
tags:
    - attack.defense_evasion
    - attack.t1218
    - attack.t1564.004
    - attack.t1552.001
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr:
        - CommandLine|contains: findstr
        - Image|endswith: 'findstr.exe'
        - OriginalFileName: 'FINDSTR.EXE'
    selection_cli_download_1:
        CommandLine|contains:
            - ' /v '
            - ' -v '
    selection_cli_download_2:
        CommandLine|contains:
            - ' /l '
            - ' -l '
    selection_cli_creds_1:
        CommandLine|contains:
            - ' /s '
            - ' -s '
    selection_cli_creds_2:
        CommandLine|contains:
            - ' /i '
            - ' -i '
    condition: selection_findstr and (all of selection_cli_download* or all of selection_cli_creds*)
falsepositives:
    - Administrative findstr usage
level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bdbf5ac2-dfd5-4bb0-aec4-2732d96fb4b8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion